{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dsgvo-all-in-one-for-wp--5.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dsgvo_all_in_one_for_wp_project:dsgvo_all_in_one_for_wp:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"id":"CVE-2026-96741"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DSGVO All in one for WP (\u003c= 5.0)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","wordpress","cve-2026-96741"],"_cs_type":"advisory","_cs_vendors":["DSGVO All in one for WP"],"content_html":"\u003cp\u003eThe DSGVO All in one for WP plugin for WordPress (versions 5.0 and earlier) contains a stored cross-site scripting (XSS) vulnerability. The flaw arises from insufficient input sanitization and output escaping when processing comment content. Exploitation is contingent upon an administrator enabling the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' setting. Furthermore, the malicious payload must be submitted via a comment and subsequently approved by a site administrator. Successful exploitation allows for the execution of arbitrary scripts within the context of a user's browser when they access the affected page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of any user viewing the page containing the injected comment. This could lead to session hijacking, unauthorized actions performed on behalf of the user, or further client-side exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the 'DSGVO All in one for WP' plugin to a version addressing the vulnerability (when released).\u003c/li\u003e\n\u003cli\u003eAs a temporary mitigation, disable the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option within the plugin settings to remove the exploitation vector.\u003c/li\u003e\n\u003cli\u003eImplement strict comment moderation policies to prevent unapproved or suspicious content from being rendered on the site.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T05:03:56Z","date_published":"2026-10-29T05:03:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dsgvo-xss/","summary":"The DSGVO All in one for WP plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of comment content when specific integration settings are enabled.","title":"DSGVO All in one for WP: Stored Cross-Site Scripting (CVE-2026-96741)","url":"https://feed.craftedsignal.io/briefs/2026-10-dsgvo-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - DSGVO All in One for WP (\u003c= 5.0)","version":"https://jsonfeed.org/version/1.1"}